Vulnerability Details : CVE-2015-0934

Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename.

Vulnerability category: Execute code

Published 2015-03-04 02:59:03

Updated 2015-03-04 19:10:01

Source CERT/CC

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-0934

Probability of exploitation activity in the next 30 days: 0.29%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 65 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2015-0934

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2015-0934

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-0934

http://www.kb.cert.org/vuls/id/302668

VU#302668 - ShareLaTeX vulnerable to remote command execution and information disclosure
Third Party Advisory;US Government Resource

CVEs referencing this url

Products affected by CVE-2015-0934

Sharelatex » Sharelatex
Versions up to, including, (<=) 0.1.2
cpe:2.3:a:sharelatex:sharelatex:*:*:*:*:*:*:*:*
Matching versions